https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:08:26.264134+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44501 CVE-2026-44501 — DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability 2026-10-08T14:08:26.280275+00:00

Affected: datahub-project datahub

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.